Phoenix Contact CHARX SEC Network Configuration Script OS Command Injection Local Privilege Escalation

CVE-2026-44095 is an OS command injection (CWE-78) in a network configuration script shipped on Phoenix Contact CHARX SEC-3000, SEC-3050, SEC-3100, and SEC-3150 EV charging controllers running firmware versions 1.0.0 through 1.9.0. A low-privileged local user — such as the charx-web service account — can inject arbitrary commands into the script, which the system executes as root. The result is full device compromise: confidentiality, integrity, and availability. The fix is firmware 1.9.1, expected no later than August 12, 2026.

The vendor's HIGH / 7.8 rating is honest and nearly right. This CVE is one of 22 flaws disclosed in advisory VDE-2026-008, several of which are unauthenticated remote RCE at CVSS 9.8. CVE-2026-44095 by itself requires local access, which is hard to get on an embedded Linux appliance — but it becomes trivially chainable with any of the five CRITICAL remote-entry CVEs in the same advisory. On its own the 7.8 is slightly generous because local shell access to a purpose-built controller is not the same as local access on a general-purpose server; noisgate adjusts to 7.0 while respecting the OT floor.

Sources.

1. NVD — CVE-2026-44095
2. CERT@VDE Advisory VDE-2026-008
3. Canadian Centre for Cyber Security — AV26-546
4. VicOne — Pwn2Own Automotive CHARX SEC-3100 RCE Analysis
5. runZero — Finding Affected Phoenix Contact Assets
6. SecurityWeek — ICS Patch Tuesday: Phoenix Contact Fixes
7. Phoenix Contact PSIRT

Run this script on the CHARX SEC controller itself via SSH or serial console as any user. Invoke with: bash check_cve_2026_44095.sh. No special privileges required — it only reads the firmware version string.

#!/bin/bash
# check_cve_2026_44095.sh
# Checks if Phoenix Contact CHARX SEC firmware is vulnerable to CVE-2026-44095
# Output: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 1=VULNERABLE, 0=PATCHED, 2=UNKNOWN

FIXED_VERSION="1.9.1"

# Try common firmware version file locations on CHARX embedded Linux
FW_VERSION=""
for f in /etc/firmware_version /etc/charx_version /etc/version /data/charx-system-config/version; do
  if [ -f "$f" ]; then
    FW_VERSION=$(cat "$f" | grep -oE '[0-9]+\.[0-9]+\.[0-9]+'| head -1)
    break
  fi
done

# Fallback: try charx CLI if available
if [ -z "$FW_VERSION" ] && command -v charx-info &>/dev/null; then
  FW_VERSION=$(charx-info --version 2>/dev/null | grep -oE '[0-9]+\.[0-9]+\.[0-9]+' | head -1)
fi

if [ -z "$FW_VERSION" ]; then
  echo "UNKNOWN - Could not determine firmware version. Verify manually."
  exit 2
fi

echo "Detected firmware version: $FW_VERSION"
echo "Fixed version: $FIXED_VERSION"

# Compare versions
version_gte() {
  printf '%s\n%s' "$1" "$2" | sort -V | head -1 | grep -qx "$2"
}

if version_gte "$FW_VERSION" "$FIXED_VERSION"; then
  echo "PATCHED - Firmware $FW_VERSION >= $FIXED_VERSION"
  exit 0
else
  echo "VULNERABLE - Firmware $FW_VERSION < $FIXED_VERSION (CVE-2026-44095)"
  exit 1
fi